A large and coordinated malware attack hit key parts of Ukraine’s infrastructure Tuesday, taking a toll on government agencies, electric grids, stores, and banks. Computers are being hit by a ransomware program called Petya that demands a $300 bitcoin payment to retrieve files.
“You became victim of the PETYA RANSOMWARE!” reads the text on a red screen in a photo posted by Ukraine’s government portal on Facebook.
“The harddisks of your computer have been encrypted with an military grade encryption algorithm,” the message continues. “There is no way to restore your data without a special key.”
The malware promises to provide a specialized key to users who pay a ransom of $300 in bitcoins.
Ukraine’s security experts are working to fix the problem, the government portal says. For now, it recommends Ukrainians simply turn their computers off.
While the malware’s most concentrated effects were reported in Ukraine, several companies and at least one utility in Russia were also reportedly affected.
The attack struck at 2 p.m. local time, Ukraine’s government says. Ukraine’s National Bank was among the first to report a problem. In Russia, the malware hit companies such as Mars, Nivea and Mondelez International, according to the Tass news agency.
Ukraine’s Anton Gerashchenko, a lawmaker and advisor to the interior minister. He says that despite its appearance as a ransomware hack, he believes the attack is actually the work of Russian agents who are waging a type of hybrid warfare to try to destabilize Ukraine.
Gerashchenko made that case on his Facebook page, as well as in a TV interview Tuesday, according to the Interfax Ukraine news agency.
From Moscow, NPR’s Lucian Kim reports, “Ukraine has blamed Russia for cyber attacks in the past, a charge Moscow denies. A number of Russian companies, including the state oil giant Rosneft, have also reported suffering cyberattacks today.”
The malware was delivered in emails that had been created to resemble business correspondence, Gerashchenko said on his Facebook page. He added that the attack took days and likely weeks to stage before being activated.